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MEMORANDUM  FOR  AUDITOR  GENERAL,  DEPARTMENT  OF  THE  ARMY 

SUBJECT:  Audit  Report  on  Army  Medical  Research  Institute  of  Infectious  Diseases 
Preparation  for  the  Year  2000  (Report  No.  99-035) 


We  are  providing  this  audit  report  for  information  and  use.  We  considered 
management  comments  on  a  draft  of  this  report  when  preparing  the  final  report. 

We  received  comments  from  the  Deputy  Assistant  Secretary  of  the  Army 
(Military  Personnel  Management  and  Equal  Opportunity  Policy)  that  were  responsive  to 
the  finding  and  the  recommendations.  Management  comments  conformed  to  die 
requirements  of  DoD  Directive  7650.3;  therefore,  no  additional  comments  are  required. 
As  a  result  of  the  comments  from  the  Deputy  Assistant  Secretary,  we  revised  the  finding 
text  to  agree  with  his  alternative  wording. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Raymond  A.  Spencer  at  (703)  604-9071 
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Appendix  B  for  the  report  distribution.  The  audit  team  members  are  listed  inside  the 
back  cover. 
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Assistant  Inspector  General 
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Army  Medical  Research  Institute  of  Infectious 
Diseases  Preparation  for  Year  2000 


Executive  Summary 


Introduction.  This  report  is  one  of  a  series  being  issued  by  the  Inspector  General,  DoD, 
in  accordance  with  an  informal  partnership  with  die  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  in  addressing  the  year  2000  computing  problem.  Information 
technology  systems  have  typically  used  two  digits  to  represent  the  year,  such  as  “  98” 
representing  1998,  to  conserve  electronic  data  storage  and  to  reduce  operating  costs. 

With  the  two-digit  format,  however,  the  year  2000  is  indistinguishable  from  1900.  As  a 
result  of  the  ambiguity,  computers,  associated  systems,  and  application  programs  that  use 
dates  to  calculate,  compare,  and  sort  could  generate  incorrect  results  when  working  with 
years  after  1999. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  Army 
Medical  Research  Institute  of  Infectious  Diseases  is  adequately  preparing  its  information 
technology  systems  to  resolve  date-processing  issues  regarding  the  year  2000  computing 
problem.  Specifically,  we  determined  whether  the  Army  Medical  Research  Institute  of 
Infectious  Diseases  complied  with  the  DoD  Year  2000  Management  Plan. 

Audit  Results.  The  Army  Medical  Research  Institute  of  Infectious  Diseases  has  not 
completed  actions  for  year  2000  issues  to  ensure  that  mission-essential  systems  will 
successfully  operate  at  the  year  2000  and  beyond.  As  a  result,  the  Army  Medical 
Research  Institute  of  Infectious  Diseases  cannot  ensure  that  information  technology 
systems  and  ongoing  research  efforts  will  not  have  year  2000  date-processing  problems 
and  be  ready  for  the  turn  of  the  century. 

Summary  of  Recommendations.  We  recommend  that  the  Commander,  Army  Medical 
Research  Institute  of  Infectious  Diseases,  complete  the  year  2000  assessment  inventories; 
develop  cost  estimates,  formal  test  plans,  and  contingency  plans;  document  whether  each 
research  project  and  related  research  specific  information  technology  are  year  2000 
compliant;  and  establish  procedures  that  would  require  the  Army  Medical  Research 
Institute  of  Infectious  Diseases  personnel  to  determine  and  notify  the  Army  Medical 
Research  Acquisition  Activity  of  any  contract  deliverable  that  requires  date-  and  time¬ 
processing  and  year-2000-compliant  technology. 
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Management  Comments.  The  Deputy  Assistant  Secretary  of  the  Army  (Military 
Personnel  Management  and  Equal  Opportunity  Policy)  concurred  with  the  finding  and 
recommendations.  See  Part  I  for  a  summary  of  management  comments  and  Part  III  for 
the  complete  text  of  the  comments. 

Audit  Response.  Comments  of  the  Deputy  Assistant  Secretary  of  the  Army  (Military 
Personnel  Management  and  Equal  Opportunity  Policy)  were  responsive.  As  a  result  of 
the  comments  to  the  draft  report,  we  revised  the  finding  text  to  agree  with  the  alternative 
wording  that  the  Deputy  Assistant  Secretary  of  the  Army  (Military  Personnel 
Management  and  Equal  Opportunity  Policy)  requested. 
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Part  I  -  Audit  Results 


Audit  Background 


Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  year  2000 
problem  and  that  the  head  of  each  agency  ensure  that  efforts  to  address  the 
year  2000  problem  receive  the  highest  priority  attention  in  the  agency. 

The  Secretary  of  Defense  issued  the  memorandum  “Year  2000  Compliance”  on 
August  7,  1998,  and  stated  that  the  year  2000  computer  problem  is  a  critical 
national  Defense  issue.  He  also  stated  that  Military  Departments  will  be 
responsible  for  ensuring  that  the  list  of  mission-critical  systems  under  their 
respective  purview  is  accurately  reported  in  the  DoD  year  2000  database 
effective  October  1,  1998.  The  DoD  Components  must  report  and  explain  each 
change  in  mission-critical  designation  to  the  Office  of  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  within 
1  month  of  the  change. 

The  Deputy  Secretary  of  Defense  issued  the  memorandum  “Year  2000  (Y2K) 
Verification  of  National  Security  Capabilities”  on  August  24,  1998.  The 
memorandum  includes  a  requirement  that  the  Assistant  Secretary  of  Defense 
(Health  Affairs)  provides  a  comprehensive  Year  2000  testing  plan  for  health  and 
medical  support  systems  by  November  1,  1998. 

Public  Law  105-271,  “Year  2000  Information  and  Readiness  Disclosure  Act,” 
October  19,  1998,  is  intended  to  encourage  the  disclosure  and  exchange  of 
information  about  computer  processing  problems,  solutions,  test  practices  and 
test  results,  and  related  matters  in  connection  with  the  transition  to  the 
year  2000. 

Department  of  the  Army  Year  2000  Action  Plan.  The  Department  of  the 
Army  Year  2000  Action  Plan  (the  Army  Action  Plan)  implements  the  DoD 
Management  Plan.  The  Army  Chief  Information  Officer,  who  is  responsible  for 
providing  assistance  and  oversight  to  Army  organizations  in  resolving  the 
year  2000  problem,  issued  the  Army  Action  Plan,  which  provides  the  Army  - 
strategy  and  management  approach  to  satisfying  the  year  2000  problem.  The 
Army  Action  Plan  discusses  each  of  the  five  phases  identified  in  the  DoD 
Management  Plan  and  establishes  Army  target  completion  dates  for  each  phase. 
The  five  phases  are  discussed  as  follows. 

•  Phase  I  -  Awareness.  Familiarize  Army  personnel  with  the  possible 
year  2000  impact,  define  the  year  2000  problem,  identify  and  educate  year  2000 
point  of  contact,  and  decide  the  organization  approach.  Awareness  is 
accomplished  through  organization  memorandums,  articles  in  Army 
publications,  e-mails,  briefings,  site  visits,  and  other  means  as  appropriate. 
Target  completion  of  the  awareness  phase  was  December  1996. 
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•  Phase  II  -  Assessment.  Determine  the  impact  of  the  year  2000  on  the 
organization’s  inventory  including  hardware,  software,  firmware,  and  develop 
acceptable  solutions;  estimate  resource  requirements  to  accomplish  year  2000 
solutions;  and  develop  contingency  plans  for  the  organization.  Target 
completion  of  the  assessment  phase  was  March  1997. 

•  Phase  III  -  Renovation.  Develop  and  fix  the  actual  correction  of  the 
year  2000  problems  for  each  system.  Target  completion  of  the  renovation  phase 
was  September  1998. 

•  Phase  IV  -  Validation.  Test  and  verify  the  correctness  of  the 
renovated  or  replaced  systems.  All  systems  must  undergo  the  validation 
process,  including  systems  assessed  as  having  no  year  2000  impact.  Target 
completion  for  the  validation  phase  is  December  1998. 

•  Phase  V  -  Implementation.  Systems  are  considered  fully  operational 
after  being  certified  as  year  2000  compliant.  Target  completion  date  is 
December  1998. 

Army  Medical  Department  Year  2000  Compliance  Plan.  The  Army  Medical 
Department  Year  2000  compliance  plan,  issued  on  April  16,  1998,  applies  to  all 
automated  information  systems;  other  systems  with  embedded  microprocessors 
and  their  communications  devices;  and  all  Army  Medical  Command 
organizations  and  installations.  The  compliance  plan  places  the  authority  and 
resource  responsibility  for  resolving  year  2000  issues  with  Army  Medical 
Command  installations  and  major  subordinate  commands.  The  Tri-Service 
Infrastructure  Management  Program  Office,  as  the  executive  agency  for  the 
Military  Health  System  infrastructure,  is  responsible  for  the  compliance  of 
infrastructure  computing  devices. 

Tri-Service  Infrastructure  Management  Program  Office  Guidance.  The 
Tri-Service  Infrastructure  Management  Program  Office,  developed  a  draft 
guide.  May  27,  1998,  to  assist  the  Military  Health  System  site  managers  in 
inventorying,  assessing,  and  fixing  the  Military  Health  System  biometric 
equipment  and  components  by  September  1,  1998,  and  replacing  its 
noncompliant  components  by  December  1,  1998.  In  addition,  the  Tri-Service 
Infrastructure  Management  Program  Office  guide  helps  Military  Health  System 
organizations  and  facilities  to  inventory  and  determine  whether  the  information 
infrastructure  is  year  2000  compliant.  The  results  were  to  yield  a  prioritized  list 
of  computers,  network  components,  operating  systems,  and  office  automation 
software  packages  that  must  be  replaced. 

Biomedical  Equipment  Year  2000  Compliance  Policy.  On  April  15,  1998, 
the  Headquarters,  Army  Medical  Command,  issued  guidance  for  assessing 
biomedical  equipment  for  year  2000  compliance.  The  Army  Medical  Command 
recognized  that  the  year  2000  data-processing  problem  poses  a  significant 
management  and  technical  challenge  and  planned  to  examine  all  biomedical 
equipment  within  the  command.  The  examination  was  to  identify  the 
biomedical  equipment  as  year  2000  compliant,  noncompliant,  or  noncompliant 
and  not  updateable  by  December  1,  1998.  The  Army  Medical  Command  was  to 
remove  any  biomedical  equipment  identified  as  noncompliant  from  service 
before  December  1,  1998. 
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Army  Medical  Research  Institute  of  Infectious  Diseases.  The  Army  Medical 
Research  Institute  of  Infectious  Diseases  (the  Institute),  a  subordinate  command 
of  the  Army  Medical  Research  and  Materiel  Command,  is  the  lead  medical 
research  laboratory  for  the  Biological  Defense  Research  Program.  The  Institute 
conducts  research  to  develop  strategies,  products,  information,  procedures,  and 
training  programs  for  medical  defense  against  biological  warfare  threats  and 
naturally  occurring  infectious  diseases  that  require  special  containment.  The 
Institute  plays  a  key  role  in  national  defense  and  infectious  disease  research  as 
the  only  biological  containment  laboratory  in  DoD  for  hazardous  diseases. 


Audit  Objectives 


Our  primary  audit  objective  was  to  determine  whether  the  Institute  was 
preparing  its  information  technology  systems  to  resolve  date-processing  issues 
for  the  year  2000  computing  problem.  Specifically,  the  audit  determined 
whether  the  Institute  had  complied  with  the  DoD  Year  2000  Management  Plan 
and  the  Army  Action  Plan.  Appendix  A  describes  the  audit  scope  and 
methodology  and  prior  audit  coverage. 
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Status  of  the  Army  Medical  Research 
Institute  of  Infectious  Diseases  Year  2000 
Program 

The  Institute  had  taken  positive  steps  to  address  the  year  2000  problem. 
However,  it  has  not  completed  actions  for  year  2000  issues  to  ensure  that 
mission-essential  systems  will  successfully  operate  after  the  turn  of  the 
century.  This  condition  exists  because  the  Institute  did  not  receive  draft 
year  2000  guidance  until  April  1998.  As  a  result,  the  Institute  could  not 
ensure  that  information  technology  systems  and  ongoing  research  efforts 
will  not  have  year  2000  date-processing  problems. 


The  Institute’s  Year  2000  Strategy 


The  Institute  follows  the  Army  Medical  Command  policy  and  guidance,  derived 
from  the  DoD,  Office  of  Assistant  Secretary  of  Defense  for  Health  Affairs, 

Year  2000  Plan  and  the  Department  of  the  Army  Year  2000  Action  Plan,  for 
determining  whether  the  Institute  has  a  potential  year  2000  impact. 

The  Institute  has  divided  the  year  2000  process  into  three  areas:  biomedical 
equipment,  facility  infrastructure,  and  automated  information  systems.  The 
biomedical  equipment  encompasses  scanners,  magnetic  resonance  imaging 
systems,  patient  monitoring  systems,  and  other  similar  systems.  Examples  of 
the  Institute’s  biomedical  equipment  include  electronic  microscopes,  autoclaves, 
incubators,  centrifuges,  and  analyzers.  The  facility  infrastructure  includes 
heating,  ventilation,  and  air  conditioning  systems;  sprinkler  systems;  facsimile 
machines;  and  elevator  systems.  The  automated  information  systems  consists  of 
automated  information  and  information  technology  systems,  such  as  personal 
computers,  servers,  and  communications  hardware  and  software.  The  Institute 
designated  a  year  2000  focal  point  in  each  of  the  three  areas  that  it  is  responsible 
for  determining  year  2000  compliance. 


Awareness 


The  Institute  took  action  to  correct  the  year  2000  problem  in  its  security  system 
and  added  year  2000  contracting  language  to  its  contracts  before  April  1998. 
However,  die  Institute  did  not  begin  addressing  the  year  2000  computer  problem 
for  its  biomedical  equipment,  facility  infrastructure,  and  automated  information 
systems  before  April  1998.  The  Institute  received  draft  Army  Medical 
Command  year  2000  compliance  guidance  in  April  1998  and  compliance 
guidance  for  the  biomedical  equipment  on  April  14,  1998.  The  Institute  facility 
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Status  of  the  Army  Medical  Research  Institute  of  Infectious  Diseases 
Year  2000  Program _ 


manager  received  guidance  for  the  facility  infrastructure  on  April  21,  1998. 

The  Institute  Chief  Information  Officer,  responsible  for  commercial  off-the-shelf 
computer  equipment,  software,  embedded  systems,  and  the  local  area  network, 
did  not  receive  guidance  until  June  20,  1998. 

At  the  time  of  the  audit,  year  2000  issues  were  being  discussed  at  command 
briefings  and  in  messages  from  higher  command,  but  the  Institute  had  not  issued 
internal  year  2000  guidance. 


Inventory  and  Assessment 


The  Institute’s  assessment  phase  was  more  inclusive  than  the  assessment  phase 
defined  in  the  Army  Action  Plan.  Items  listed  in  the  biomedical  equipment, 
facility  infrastructure,  and  automated  information  systems  inventories  are 
generally  commercial-off-the-shelf.  The  Institute’s  assessment  phase  not  only 
requires  the  inventory  and  assessment,  but  also  requires  fixing  or  replacing 
noncompliant  systems. 

Inventory.  Each  of  the  Institute’s  three  areas,  biomedical  equipment,  facility 
infrastructure,  and  automated  information  systems,  maintained  separate 
inventories.  As  of  July  1998,  the  biomedical  inventory  listed  1,971  systems, 
which  the  Institute  classified  as  low  risk  because  the  equipment  does  not  have 
any  serious  impact  on  patient  safety.  The  facility  manager  maintains  an 
inventory  of  all  facility  infrastructure  equipment.  The  automated  information 
systems  inventory  lists  computer  equipment,  software,  and  embedded  systems, 
which  the  Chief  Information  Officer  considers  are  essential  to  the  Institute’s 
mission.  The  automated  information  systems  inventory  does  not  include 
research-specific  software. 

Biomedical  Assessment.  The  Institute  was  performing  year  2000  assessments 
as  part  of  its  routine  biomedical  equipment  maintenance.  Of  the 
1,971  biomedical  equipment  systems,  the  Institute  assessed  the  compliance  of 
1,719  and  found  that  7  were  noncompliant.  In  addressing  the  noncompliance  of 
the  seven  systems,  the  Institute  reported  that  four  required  either  new  software 
or  a  software  upgrade;  one  required  a  computer  chip  replacement;  one  required 
the  operator  to  manually  update  the  date  for  leap  year;  and  one  required  an 
operating  system  upgrade.  The  cost  to  make  six  of  the  seven  systems  year  2000 
compliant  is  about  $40,000;  the  cost  for  the  remaining  system  was  unknown. 
The  Institute  expects  to  identify  and  fix  all  the  biomedical  equipment  by 
November  1998. 

Facility  Infrastructure  Assessment.  The  Institute  did  not  assess  the  facility 
infrastructure  inventory  for  year  2000  compliance.  The  Army  Medical 
Research  and  Materiel  Command  Year  2000  guidance  requires  the  Institute  to 
identify  and  fix  facility  systems  by  October  1998.  The  facility  manager 
identified  the  heating,  ventilation,  and  air  conditioning  system;  the  fire  detection 
system;  and  the  chillers  as  potential  year  2000  problems.  The  facility  manager 
is  working  with  the  system  vendors  to  determine  the  extent  of  the  year  2000 
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Status  of  the  Army  Medical  Research  Institute  of  Infectious  Diseases 

Year  2000  Program 


problem  and  the  cost  to  make  the  systems  year  2000  compliant.  The  Institute 
replaced  its  physical  security  system  in  1997  because  it  was  not  year  2000 
compliant.  Based  on  an  August  20,  1997,  vendor  statement,  the  system 
software  is  year  2000  compliant. 

Automated  Information  Systems  Assessment.  At  the  time  of  the  audit,  the 
Institute  had  not  completed  its  year  2000  compliance  assessment  of  the 
equipment  or  application  software.  Although  the  Institute  has  identified  some  of 
the  noncompliant  mission-essential  software,  it  has  contracted  one  programmer 
to  fix  only  some  of  the  software  modules.  However,  an  additional  year  of 
computer  programmer  effort  is  needed  to  fix  the  remaining  software  modules  for 
which  funding  was  not  available.  All  components  of  a  new  local  area  network 
being  installed  in  the  Institute  are  year  2000  compliant.  Completed  of  the  local 
area  network  is  scheduled  for  December  31,  1998. 

Test  Plans.  The  Institute  has  not  developed  a  test  plan,  as  required  by  the 
Army  Medical  Command  guidance.  The  Institute  plans  to  test  the  biomedical 
and  automated  information  systems  computer  hardware  using  Army  Medical 
Command-approved  software.  However,  not  all  systems  can  be  tested  with  the 
year  2000  testing  software,  and  the  Institute  has  no  formal  test  plan  for  the  new 
physical  security  system  or  research  databases. 

Cost  Plans.  The  Institute  has  not  developed  a  cost  plan  for  expenditures  related 
to  the  year  2000  problem,  as  required  by  Army  Medical  Command  guidance. 
The  Institute  lacks  funds  to  upgrade  or  replace  noncompliant  biomedical 
equipment,  facility  infrastructure,  and  automated  information  systems  for 
FY  1998  and  FY  1999.  The  Institute  should  identify  the  funds  needed  to  meet 
the  December  31,  1998,  deadline.  The  Institute  identified  funding  requirements 
of  about  $100,000  for  mission-essential  software  and  about  $40,000  for 
biomedical  equipment;  however,  it  did  not  develop  additional  funding 
requirements  because  it  has  not  completed  its  inventory  and  assessments. 

Contingency  Plans.  The  Institute  has  not  developed  contingency  plans  because 
it  believes  that  it  will  be  year  2000  compliant  by  December  31,  1998.  The 
Institute  began  planning  the  automated  information  systems  and  facility 
infrastructure  inventory  assessment  in  July  1998,  which  was  not  sufficient  time 
to  complete  the  inventory  assessment  and  fix  or  replace  noncompliant  systems 
prior  to  this  audit.  The  Institute  has  identified  noncompliant,  mission-essential 
software  that  cannot  be  fixed  or  replaced  by  December  31,  1998.  Also,  the 
Institute  has  identified  funding  shortages  and  expects  additional  funding 
shortages  as  it  assesses  the  inventory.  These  issues  and  the  approaching  century 
makes  contingency  planning  even  more  critical  for  those  systems  not  assessed 
for  the  year  2000  impact,  especially  when  the  Institute  does  not  have  a 
comprehensive  inventory. 
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Status  of  the  Army  Medical  Research  Institute  of  Infectious  Diseases 
Year  2000  Program _ 


Research  Programs 


The  Institute  did  not  assess  the  potential  year  2000  impact  on  ongoing  research 
programs  including  researcher-developed  databases.  The  Institute  conducts 
research  to  develop  strategies,  products,  information,  procedures,  and  training 
programs  for  the  medical  defense  against  biological  warfare  threats  and 
naturally  occurring  infectious  diseases  that  require  special  containment.  The 
Institute  needs  to  assess  each  research  project,  including  vital  databases 
generated  by  the  researchers,  to  prevent  the  loss  of  the  vital  research 
information. 


Contracting 


The  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  policy  memorandum  to  the 
Secretaries  of  the  Military  Departments  and  the  Directors  of  the  Defense 
agencies  on  “Acquisition  of  Year  2000  Compliant  Information  Technology  (IT) 
and  Bringing  Existing  IT  Into  Compliance,”  December  18,  1997.  The 
memorandum  required  the  review  of  information  technology  contracts  and  other 
acquisition  instruments  to  determine  whether  modifications  are  necessary.  The 
memorandum  states  that  orders  for  information  technology  shall  not  be  placed 
on  a  contract  or  other  acquisition  instrument  unless  the  information  technology 
purchase  is  year  2000  compliant. 

The  Army  Medical  Research  Acquisition  Activity  (the  Acquisition  Activity) 
performs  contracting  services  for  the  Institute  and  has  incorporated  the 
year  2000  clause  in  IT  contracts  since  late  1996.  The  audit  confirmed  the 
inclusion  of  the  year  2000  clause  from  a  sampling  of  contracts;  however,  the 
contract  for  the  security  system  at  the  Institute,  dated  June  3,  1997,  did  not 
contain  the  required  year  2000  clause.  At  our  request,  the  Institute  obtained  a 
year  2000-compliance  statement  from  the  security  system  contractor. 

The  Institute  does  not  require  its  personnel  to  provide  year  2000  information  on 
purchase  requests.  The  Deputy  for  Acquisition  Policy  and  Support  of  the 
Acquisition  Activity  voiced  concern  that  Acquisition  Activity  contracting 
officers  and  Institute  personnel  are  not  discussing  IT-related  contracts  for 
possible  year  2000  problems  and  the  need  for  the  year  2000  clause.  The 
Institute  needs  to  establish  procedures  that  would  require  the  Institute  personnel 
to  determine  and  then  notify  the  Acquisition  Activity  contracting  officers  of  any 
contract  requiring  date  and  time  processing. 
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Status  of  the  Army  Medical  Research  Institute  of  Infectious  Diseases 
_ Year  2000  Program 


Recommendations  and  Management  Comments 


We  recommend  that  the  Commander,  Army  Medical  Research  Institute  of 
Infectious  Diseases: 

1.  Complete  the  year  2000  assessment  of  the  automated  information 
systems  and  facility  infrastructure  inventories  to  include: 

a.  Adding  research-specific  computer  hardware,  software,  and 
databases; 

b.  Developing  cost  plans  to  fix  noncompliant  year  2000  systems  and 
equipment; 

c.  Requesting  funding  assistance  from  higher  command; 

d.  Developing  test  plans  for  mission-essential  systems  and  databases; 

and 

e.  Developing  contingency  plans  for  noncompliant  hardware  or 
software. 

Management  Comments.  The  Deputy  Assistant  Secretary  of  the  Army 
(Military  Personnel  Management  and  Equal  Opportunity  Policy)  concurred, 
stating  that  the  Institute  has  inventoried  all  biomedical  equipment,  facility 
infrastructure,  and  automated  information  systems  and  is  in  the  process  of 
inventorying  research-specific  software  and  databases.  The  Institute  has  either 
completed  or  is  in  the  process  of  completing  the  year  2000  compliance 
assessment  and  plan  to  upgrade  or  replace  noncompliant  hardware  or  software 
by  December  31,  1998. 

2.  Document  whether  each  research  project  is  year  2000  compliant  and 
report  the  results  through  the  Institute’s  Chief  Information  Officer. 

Management  Comments.  The  Deputy  Assistant  Secretary  of  the  Army 
(Military  Personnel  Management  and  Equal  Opportunity  Policy)  concurred, 
stating  that  the  Army  Medical  Research  Institute  of  Infectious  Diseases  has 
inventoried  all  personal  computers  and  biomedical  instruments  and  will  ensure 
year  2000  compliance  by  December  31,  1998. 

3.  Establish  procedures  that  require  Institute  personnel  to  notify  the  Army 
Medical  Research  Acquisition  Activity  of  the  need  to  include  the  year  2000 
clause  in  future  contract  efforts. 

Management  Comments.  The  Deputy  Assistant  Secretary  of  the  Army 
(Military  Personnel  Management  and  Equal  Opportunity  Policy)  concurred, 
stating  that  the  Army  Medical  Research  Institute  of  Infectious  Diseases’  policy 
requires  the  Logistics  Division  to  ensure  that  a  year  2000  compliance  clause  is 
contained  of  all  date-related  information  technology  item  acquisitions. 


9 


Appendix  A.  Audit  Process 


This  in  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

For  a  listing  of  audit  projects  addressing  this  issue,  see  the  year  2000  webpage 
on  IGnet  at  <http://www.ignet.gov  > . 


Scope 


Work  Performed.  We  reviewed  and  evaluated  the  progress  of  the  Institute  in 
resolving  the  year  2000  computing  issue.  We  evaluated  the  year  2000  efforts  of 
The  Institute;  compared  the  actions  with  the  Army  Action  Plan;  conducted 
discussions  with  technical,  business,  and  contracting  officials;  and  evaluated 
year  2000  documentation  where  available. 

DoD-Wide  Corporate  Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  the  DoD 
has  established  6  DoD-wide  corporate-level  performance  objectives  and  14  goals 
for  meeting  those  objectives.  This  report  pertains  to  achievement  of  the 
following  objective  and  goal: 

•  Objective:  Prepare  now  for  the  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  warfighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  functional  area  objective  and 
goal: 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  services  that  satisfies  customer  information  needs. 

•  Goal:  Upgrade  technology  base.  (ITM-2.3) 

General  Accounting  Office  High-Risk  Area.  In  its  identification  of  risk  areas, 
the  General  Accounting  Office  has  specifically  designated  risk  in  resolution  of 
the  year  2000  problem  as  high.  This  report  provides  coverage  of  that  problem 
and  of  the  overall  Information  Management  and  Technology  high-risk  area. 
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Appendix  A.  Audit  Process 


Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  during  July  1998,  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States,  as  implemented  by  the 
Inspector  General,  DoD.  We  did  not  rely  on  computer-processed  data  or 
statistical  sampling  procedures  to  develop  conclusions  on  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognizes  the 
year  2000  issue  as  a  material  management  control  weakness  area  in  the  FY  1997 
Annual  Statement  of  Assurance. 


Summary  of  Prior  Coverage 


The  General  Accounting  Office,  the  Inspector  General,  DoD,  and  the  Army 
Audit  Agency  have  conducted  multiple  reviews  related  to  year  2000  issues. 
General  Accounting  Office  reports  can  be  accessed  over  the  Internet  at 
http://www.gao.gov.  Inspector  General,  DoD,  reports  can  be  accessed  over  the 
Internet  at  http://www.dodig.osd.mil.  However,  there  were  no  prior  reviews 
related  to  year  2000  at  the  Institute. 


13 


Appendix  B.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Year  2000  Oversight  and  Contingency  Planning  Office 
Assistant  Secretary  of  Defense  (Health  Affairs) 

Assistant  Secretary  of  Defense  (Public  Affairs) 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Assistant  Secretary  of  the  Army  (Manpower  and  Reserve  Affairs) 

The  Surgeon  General 

Commander,  Army  Medical  Command 

Commander,  Army  Medical  Research  and  Material  Command 

Commander,  Army  Medical  Research  Institute  of  Infectious  Diseases 
Director,  Army  Medical  Research  Acquisition  Activity 
Chief  Information  Officer,  Army 
Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Chief  Information  Officer,  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 

Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
Auditor  General,  Department  of  the  Air  Force 
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Appendix  B.  Report  Distribution 


Other  Defense  Organizations 

Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison,  Defense  Information  Systems  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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DEPARTMENT  OF  THE  ARMY 
Office  Of  TV*  ASSISTANT  SECRETARY 
MANPOWER  AND  RESERVE  AFFAIRS 
111  ARMY  PENTAGON 
WASHINGTON  DC  2031M111 

October  23,  1998 


MEMORANDUM  FOR  THE  U.S.  ARMY  AUDIT  AGENCY  (USAAA),  ATTN: 

(SAAG-PMO-L),  PENTAGON  ROOM  1E515 

SUBJECT:  Draft  DODIG  Audit  Report,  Project  No.  8AB-0030.03. 16  September 
1998.  Army  Medical  Research  Institute  of  Infectious  Diseases  (USAMRIID) 
Preparation  for  the  Year  2000 


Reference  your  memorandum  of  28  September  1 998,  subject  as  above. 
Enclosed  is  the  response  to  your  request  for  review  and  action  on  the  above  draft 
report.  The  response  includes  recommended  corrections  and  clarifications  to  the 
text  of  the  report.  The  response  also  includes  a  status  report  and  projected 
completion  of  USAMRIID's  Y2K  compliance  project,  and  addresses  the 
recommendations  for  corrective  action.  We  believe  it  addresses  each  finding 
satisfactorily. 

Point  of  contact  for  this  action  is  COL  Christie  Smith  (697-1482) 


Enclosure 


y-Myi  P.  Mdiaurin,  III 
IBpputy  Assistant  Secretary 
(Military  Personnel  Management 
and  Equal  Opportunity  Policy) 


Prtn»»dorj  Racyctod 
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DEPARTMENT  OF  THE  ARMY 
OFFICE  OF  TOE  SURGEON  GENERAL 
51 W  LEESBURG  PIKE 
FALLS  CHURCH  VA  22041-3256 
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MEMORANDUM  THRU  DIRECTOR  QFT1 1C  ARMY-STAFF- 
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1998 


FOR  THE  ASSISTANT  SECRETARY  OF  THE  ARMY  (MANPOWER  AND 
RESERVE  AFFAIRS) 

SUBJECT-  Draft  Audit  Report  on  Army  Medical  Research  Institute  of  Infectious 
Diseases  Preparation  for  Year  2000  (Project  No.  8AB-0030.03),  16  Sept  1998 


1  Attached  is  the  command  response  to  the  subject  draft  report  on  Army 
Medical  Research  Institute  of  Infectious  Diseases  Preparation  for  Year  2000 

2  We  support  the  U.S  Army  Medical  Research  and  Materiel  Command’s 
concurrence  with  the  findings,  recommendations  and  their  command  responses 
for  corrective  actions.  We  believe  their  ongoing  and  future  planned  corrective 
actions  meet  the  intent  of  the  DODIG'S  recommendations. 

3  The  POC  for  this  memorandum  is  Carmine  Mendidno,  DSN  761-3248  or 
Commerdal  (703)  681-3248. 

FOR  THE  SURGEON  GENERAL: 

Atch  RICHARD  L.  URSONE 

Colonel,  MS 
Executive  Officer 
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Department  of  the  Army  Comments 


MCMR-IR  (MCMR-OIA/13  Oct  98)  1st  End  Mr.  Weimert/eas/DSN  343- 
7440 

SUBJECT:  Management  Comments  on  Draft  Audit  Report  on  Army 
Medical  Research  Institute  of  Infectious  Diseases  Preparation 
for  Year  2000  (Project  No.  8AB-0030.03) 


Commanding  General,  U.S.  Army  Medical  Research  and  Materiel 
Command,  ATTN:  MCMR-IR,  504  Scott  Street,  Fort  Detrick,  MD 
21702-5012 

FOR  Office  of  the  Surgeon  General,  ATTN:  OTSG-IR,  Room  636, 
5109  Leesburg  Pike,  Falls  Church,  VA  22041 


The  U.S.  Army  Medical  Research  and  Material  Command  concurs  with 
the  comments  of  the  U.S.  Army  Medical  Research  Institute  of 
Infectious  Diseases. 

FOR  THE  COMMANDER: 


Chief  of  Staff 


Department  of  the  Army  Comments 


Final  Report 
Reference 


REPLY  TO 
ATTENTION  Of: 


DEPARTMENT  OF  THE  ARMY 

U$  ARMY  MEDICAL  RESEARCH  INSTITUTE  OF  INFECTIOUS  OISEASES 
1425  PORTER  STREET 
FORT  OETRICK  MARYLANO  21702*501 1 


MCMR-UIA 


£ 


/ 


13  October  1998 


MEMORAtJBtJlT THRU  Commander,  U.S.  Army  Medical  Research  Institute 
y'  of  Infectious  Diseases,  ATTN:  MCMR-UIZ-A, 

1425  Porter  Street,  Fort  Detrick,  MD 
21702-5011 


FOR  U.S.  Army  Medical  Research  and  Materiel  Command, 

ATTN:  MCMR-IR  (Mr.  Weimeit),  504  Scott  Street, 

Fort  Detrick,  MD  21702-5012 

SUBJECT:  Management  Comments  on  Draft  Audit  Report  on  Army 
Medical  Research  Institute  of  Infectious  Diseases  Preparation 
for  Year  2000  (Project  No.  8AB-0030.03) ,  16  September  98 


Introduction 

These  comments  consist  of  two  sections.  Section  one  contains 
corrections  and  clarifications  to  the  text  of  the  16  Sep  98 
Draft  Report.  Section  two  contains  USAMRIID  management  comments 
on  the  Draft  Report.  The  comments  give  an  update  of  USAMRIID' s 
Y2K  project  and  also  address  the  Recommendations  for  Corrective 
Action  in  the  Draft  Report. 


Section  One 

The  following  text  from  the  Draft  Report  is  given  with  suggested 
corrections  and  clarifications.  In  this  section,  words  in 
itali c  have  been  added  to  replace  the  words  deleted  by 
strikethrough. 

Part  I  -  Audit  Results.  The  Institute's  Year  2000  Strategy, 
paragraph  two,  p5. 

"The  Institute  has  divided  the  year  2000  process  into  three 
areas:  biomedical  equipment,  facility  infrastructure,  and 
biomedical  oqulpmeftfe  automated  information  systems."  [Words  in 
italic  replace  strikethrough  words.]  The  biomedical  equipment 
encompasses  scanners,  magnetic  resonance  imaging  systems, 
patient  monitoring  systems,  and  other  similar  systems.  Examples 
of  the  Institute's  biomedical  equipment  include  electronic 
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Final  Report 
Reference 


Revised 


Revised 


Revised 


Revised 

Revised 

Revised 

Revised 

Revised 


MCMR-UIA 

Management  Comments  on  Draft  Audit  Report  on  Army  Medical  Research  Institute  of 
Infectious  Diseases  Preparation  for  Year  2000  (Project  No.  8AB-0030.03),  16  September  98 

microscopes,  autoclaves,  incubators,  centrifuges,  and  analyzers. 
The  facility  infrastructure  includes  heating,  ventilation,  and 
air  conditioning  systems;  sprinkler  systems,  facsimile  machines; 
and  elevator  systems.  The  biomedical  equipment— automated 
information  systems  consist  of  automated  information  and 
information  technology  systems,  such  as  personal  computers, 
servers,  and  communications  hardware  and  software.  The 
Institute  designated  a  year  2000  focal  point  in  each  of  the 
three  areas  that  is  responsible  for  determining  year  2000 
compliance. " 

Part  I  -  Audit  Results.  Inventory  and  Assessment,  paragraphs 
one  and  two,  p6. 

"The  Institute's  assessment  phase  was  more  inclusive  than  the 
assessment  phase  defined  in  the  Amy  Action  Plan.  Items  listed 
in  the  biomedical  equipment,  facility  infrastructure,  and 
bi-emot-rde  equipment  automated  information  systems  inventories 
are  generally  commercial-off-the-shelf.  The  Institute's 
assessment  phase  not  only  requires  the  inventory  and  assessment, 
but  also  requires  fixing  or  replacing  noncompliant  systems. 

Inventory.  Each  of  the  Institute's  three  areas,  biomedical 
equipment,  facility  infrastructure,  and  biomctri-e- equipment 
automated  information  systems,  maintained  separate  inventories. 
As  of  July  1998,  the  biomedical  inventory  listed  1.971  systems, 
which  the  Institute  classified  as  low  risk  because  the  equipment 
does  not  have  any  serious  impact  on  patient  safety.  The 
facility  manager  maintains  an  inventory  of  all  facility 
infrastructure  equipment.  The  biometr-ic  automated  information 
systems  inventory  lists  computer  equipment,  software,  and 
embedded  systems,  which  the  Chief  Information  Officer  considers 
are  essential  to  the  Institute's  mission.  The  biometric 
automated  information  systems  inventory  does  not  include 
roaoarehcr-purohaoed-  computer—  hardware-, — software-? — and-dafeabasco 
research-specific  software." 

Part  I  -  Audit  Results.  Inventory  and  assessment,  paragraphs 
five  through  eight,  p7. 

"Bioaotric  Automated  Information  Systems  Assessment.  At  the 

time  of  the  audit,  the  Institute  had  not  completed  its  year  2000 
compliance  assessment  of  the  equipment  or  appdi-aab-lo  application 
software.  Although  the  Institute  has  identified  some  of  the 
noncompliant  mission-essential  software,  it  has  contracted  one 
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programmer  to  fix  only  some  of  the  software  modules.  However, 
additional  year  of  computer  programmer  effort  is  needed  to  fix 
the  remaining  software  modules  for  which  funding  was  not 
available.  Fort---Betrl-ek--ls— upgrading  'the-  l&ealr-a-r-eo-ne-t-work-t-e 
bo  year- ao-OO-eomp-llant-by  Doeombe-r"-81-i — 19-9&-.-  All  components  of 
a  net/  local  area  network  being  installed  in  VSAMRIID  are  year 
2000  compliant.  The  LAN  upgrade  is  scheduled  to  be  completed  by 
December  31,  1998. 

Test  Plans.  The  Institute  has  not  developed  a  test  plan,  as 
required  by  the  Army  Medical  Command  Guidance.  The  Institute 
plans  to  test  the  biomedical  and  biometric  automated  information 
systems  computer  hardware  and  software  using  Amy  Medical 
Command-approved  software.  However,  not  all  systems  can  be 
tested  with  the  year  2000  testing  software,  and  the  Institute 
has  no  formal  test  plan  for  the  new  physical  security  system  or 
research  databases. 

Cost  Plans.  The  Institute  has  not  developed  a  cost  plan  for 
expenditures  related  to  the  year  2000  problem,  as  required  by 
Army  Medical  Command  guidance.  The  Institute  lacks  funds  to 
upgrade  or  replace  noncompliant  biomedical  equipment,  facility 
infrastructure,  and  biometric  equipment  automated  information 
systems  for  FY  1998  and  FY  1999.  The  Institute  should  identify 
the  funds  needed  to  meet  the  December  31,  1998  deadline.  The 
Institute  identified  funding  requirements  of  about  $100,000  for 
mission-essential  software  and  about  $40,000  for  biomedical 
equipment;  however,  it  did  not  develop  additional  funding 
requirements  because  it  has  not  completed  its  inventory  and 
assessments. 

Contingency  Plans.  The  Institute  has  not  developed  contingency 
plans  because  it  believes  that  it  will  be  year  2000  compliant  by 
December  31,  1998.  The  Institute  began  planning  the  biometric 
automated  information  systems  and  facility  infrastructure 
inventory  assessment  in  July  199B,  which  was  not  sufficient  time 
to  complete  the  inventory  assessment  and  fix  or  replace 
noncompliant  systems  prior  to  this  audit.  The  Institute  has 
identified  noncompliant,  mission-essential  software  that  cannot 
be  fixed  or  replaced  by  December  31,  1998.  Also,  the  Institute 
has  identified  funding  shortages  and  expects  additional  funding 
shortages  as  it  assesses  the  inventory.  These  issues  and  the 
approaching  century  makes  contingency  planning  even  more 
critical  for  those  systems  not  assessed  for  the  year  2000 
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impact,  especially  when  the  Institute  does  not  have  a 
comprehensive  inventory." 

Part  I  -  Audit  Results.  Recommendations  for  Corrective  Action, 

p8. 

"1.  Complete  the  year  2000  assessment  of  the  bi-orootric-  equipment 
automated  information  systems  and  facility  infrastructure 
inventories  to  include:" 


Section  Two 

This  section  contains  of  an  update  of  USAMRIID's  Y2K  project  as 
of  9  October,  1998.  It  also  addresses  the  Recommendations  for 
Corrective  Action  in  the  Draft  Report. 

Y2K  Update 

Significant  events  that  have  occurred  in  USAMRIID's  Y2K  project 
since  the  July  1998  visit  of  the  DoD  IG  survey  team  are  as 
follows: 

1 .  Biomedical  Equipment 

a.  All  biomedical  equipment  has  been  inventoried. 

b.  90%  of  the  biomedical  equipment  is  Y2K  compliant. 

c.  Estimated  cost  to  modify  or  replace  non-compliant  equipment  is 
$52,873. 

d.  Plan  is  on  schedule  for  100%  compliance  by  31  December  1998. 

2.  Facility  Infrastructure 

a.  In  September  1998  a  complete  inventory  of  all  facility 
infrastructure  items  was  conducted.  The  contractor  who 
performed  the  inventory  is  in  the  process  of  preparing  a 
detailed  summary  of  compliance  for  each  item  inventoried.  A 
plan  for  certification  will  then  be  implemented  for  any  non- 
compliant  item. 

b.  The  building  automation  monitoring  and  alarm  system  has  been 
upgraded  (hardware  and  software)  and  is  now  Y2K  compliant. 

c.  The  building  security  system  is  Y2K  compliant. 

d.  The  backup  power  system  is  Y2K  compliant. 

e.  The  elevators  are  either  Y2K  compliant  or  not  date  sensitive. 
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3.  Automated  Information  Systems 

a.  Personal  computers. 

-  100%  of  personal  computers  have  been  inventoried. 

-  98%  of  personal  computers  are  Y2K  compliant. 

-  Estimated  cost  to  replace  non-compliant  personal  computers 
is  $60,150. 

-  Plan  is  on  schedule  for  100%  compliance  by  31  December 
1998. 

b.  Local  area  network. 

-  100%  of  all  local  area  network  devices  in  USAMRIID' s  new 
LAN  are  Y2K  compliant. 

-  Installation  of  the  new  LAN  is  scheduled  for  completion  by 
31  December  1998. 

c.  Application  software. 

-  E-mail:  FY98  year-end  money  at  MEDCOM  was  identified  to 
fund  the  conversion  of  USAMRIID' s  non-compliant  cc:Mail  to 
Microsoft  Exchange,  which  is  Y2K  compliant.  This  is  part 
of  an  overall  MEDCOM  upgrade.  Implementation  will  depend 
on  USAMISSA  purchasing  and  installing  MS  Exchange,  and  on 
the  training  of  USAMRIID  Exchange  administrators.  Project 
Y2K  compliant  e-mail  by  August  1999. 

-  The  USAMRIID  Special  Immunization  System  operates  on  the 
Fort  Detrick  DOIM  mainframe  computer  system.  The  mainframe 
and  operating  system  are  Y2K  compliant.  The  application 
software  (database  and  query  software)  is  projected  by 
USAMISSA  to  be  upgraded  to  Y2K  compliance  by  31  December 
1998. 

-  Conversion  of  application  programs  to  Y2K  compliant 
programs  will  require  an  additional  two  programmer  man- 
years.  In  September  1998,  FY99  funds  were  budgeted  by  HQ, 
USAMRMC  for  these  contract  programmers  for  USAMRIID. 
Reprogramming  and  testing  is  scheduled  for  completion  by  30 
September  1999. 

-  In  September  1998  a  plan  was  initiated  to  inventory  all 
research-specific  software  in  USAMRIID.  The  inventory  will 
be  completed  by  30  October  1998,  with  plans  to 
upgrade/replace  non-compliant  software  by  31  December  1998. 
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Recommendations  for  Corrective  Action 

The  Draft  Report  Recommendations  for  Corrective  Action  are  now 
reviewed  in  light  of  the  current  status  of  Y2K  efforts  at 
USAMRIID: 

Recommendation  la:  Adding  research-specific  computer  hardware, 
software  and  databases. 

Corrective  Action  la:  All  computer  hardware  has  been 
inventoried  for  Y2K  compliance,  with  replacement  of  non- 
compliant  systems  scheduled  by  31  December  1998.  Research- 
specific  software,  including  databases,  in  now  being 
inventoried,  with  plans  to  upgrade/replace  non-compliant 
software  by  31  December  1998. 

Recommendation  lb:  Developing  cost  plans  to  fix  non-compliant 
year  2000  systems  and  equipment. 

Corrective  Action  lb:  Costs  have  been  determined  for 
replacement  of  non-compliant  biomedical  equipment  and  personal 
computers,  and  for  re-programming  of  non-compliant  software 
applications.  FY99  funds  are  budgeted  for  these  costs. 

Recommendation  lc:  Requesting  funding  assistance  from  higher 
command. 

Corrective  Action  lc:  Funds  have  been  requested  and  budgeted 
from  MEDCOM  (FY98  year-end)  and  HQ,  USAMRMC  (FY99)  to  cover  a 
significant  portion  of  projected  Y2K  compliance  expenses. 

Recommendation  Id:  Developing  test  plans  for  mission-essential 
systems  and  databases. 

Corrective  Action  Id:  As  mission-essential  systems  and 
databases  are  upgraded/replaced  during  the  next  year,  each  will 
be  specifically  tested  to  insure  that  all  date  information  is 
stored  and  referenced  using  an  eight  digit  date  field  (two 
digits  for  century)  to  insure  Y2K  compliance. 

Recommendation  le:  Developing  contingency  plans  for  non- 
compliant  hardware  of  software. 

Corrective  Action  le:  Plans  are  to  obtain  100%  compliance  for 
all  hardware  and  software  systems  by  upgrades,  replacements  and 
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reprogramming.  A  back-up  plan  for  any  system  exhibiting  a 
previously  undetected  problem  in  Jan  2000  will  be  to  roll  the 
century  date  back  to  1999  in  that  system  until  the  problem  is 
analyzed  and  corrected. 

Recommendation  2:  Document  whether  each  research  project  is 
year  2000  compliant  and  report  the  results  through  the 
Institute's  Chief  Information  Officer. 

Corrective  Action  2:  All  personal  computers  and  biomedical 
instruments  have  been  inventoried  and  will  be  Y2K  compliant  by 
31  December  1998 .  Completion  of  a  current  survey  of  research- 
specific  software  throughout  the  Institute  will  permit  any  non- 
compliant  issues  to  be  addressed  and  resolved  by  31  December 
1998. 

Recommendation  3:  Establish  procedures  that  require  Institute 
personnel  to  notify  the  Army  Medical  Research  Acquisition 
Activity  of  the  need  to  include  the  year  2000  clause  in  future 
contract  efforts. 

Corrective  Action  3:  It  is  the  policy  and  practice  of  Logistics 
Division,  USAMRIID,  to  insure  that  a  year  2000  compliance  clause 
is  contained  in  the  minimum  essential  characteristics  of  all 
acquisitions  involving  date-related  information  technology  items 
(hardware,  software,  services) . 

GLEN  A.  HIGBEBy 

Chief,  Biometgacs  &  Information 
Management  Division,  USAMRIID 
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